Re: [PATCH v4 1/2] uaccess: rust: add strncpy_from_user

["Benno Lossin" <lossin@kernel.org>]

On Sat May 31, 2025 at 3:27 PM CEST, Alice Ryhl wrote:
> On Fri, May 30, 2025 at 8:13 PM Benno Lossin <lossin@kernel.org> wrote:
>> On Tue May 27, 2025 at 2:34 PM CEST, Alice Ryhl wrote:
>> > +#[inline]
>> > +#[expect(dead_code)]
>> > +fn raw_strncpy_from_user(dst: &mut [MaybeUninit<u8>], src: UserPtr) -> Result<usize> {
>> > +    // CAST: Slice lengths are guaranteed to be `<= isize::MAX`.
>> > +    let len = dst.len() as isize;
>> > +
>> > +    // SAFETY: `dst` is valid for writing `dst.len()` bytes.
>> > +    let res = unsafe {
>> > +        bindings::strncpy_from_user(dst.as_mut_ptr().cast::<c_char>(), src as *const c_char, len)
>> > +    };
>> > +
>> > +    if res < 0 {
>> > +        return Err(Error::from_errno(res as i32));
>> > +    }
>> > +
>> > +    #[cfg(CONFIG_RUST_OVERFLOW_CHECKS)]
>> > +    assert!(res <= len);
>> > +
>> > +    Ok(res as usize)
>>
>> We probably should add a `GUARANTEES` comment here, no?
>
> I can see the idea behind such comments, but I do not believe we've
> used them so far.

Yes, but we also haven't really used `# Guarantees` all that often.

---
Cheers,
Benno